How can you distinguish between a crash and a reboot on RHEL7?

kwb asked:

Is there a way to determine whether a RHEL7 server was rebooted via systemctl (or reboot / shutdown aliases), or whether the server crashed? Pre-systemd this was fairly easy to determine with last -x runlevel, but with RHEL7 it’s not so clear.

My answer:

Funny, I just happened to reboot a CentOS 7 system last night, and so I have a nice log of just this to look at.

In the case of a crash, obviously nothing is logged between the time of the crash and the system restart.

In the case of a reboot, it is pretty obvious, as you get a log of (nearly) everything systemd is doing to shut down the system.

One such log entry you aren’t likely to see in any circumstance other than shutting down or going to single-user mode is:

Jul 13 01:27:55 yaungol systemd: Stopped target Multi-User System.

You can reboot your own system to see what actually gets logged.

View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.